To start a credit card company, you need a banking relationship (either a partnership with a sponsor bank or your own charter), licenses in the states where you plan to lend, enough capital to cover reserves and expected losses, a technology stack that can authorize and settle transactions in real time, and a compliance program built around federal consumer lending, anti-money laundering, and data security laws. Almost everyone launching today goes the sponsor bank route, which shortens the timeline from years to months but still runs into the hundreds of thousands of dollars before the first card is issued. The obligations do not stop at launch; if anything, they intensify.
What follows is what the work actually involves, in the order the decisions come up.
How Credit Card Issuers Make Money
Three revenue streams drive the business. Interchange fees are a percentage of every purchase, paid by the merchant’s bank to you as the issuer; in the U.S., that averages roughly 2% of transaction value. Interest on carried balances is usually the largest share of revenue and comes with the credit risk of cardholders who don’t pay in full. Cardholder fees include annual fees, late fees, balance transfer fees, and foreign transaction fees.
Interchange is thin per transaction and only matters at scale. Interest is lucrative per account but only if your cardholders carry balances, which means you’re absorbing default risk. That tension shapes your capitalization plan, your underwriting, and your marketing.
Sponsor Bank, Own Charter, or Private Label
The biggest structural decision is how you access the banking system.
A sponsor bank is a chartered depository institution that lets you issue cards under its license. You get a Bank Identification Number (the first six to eight digits on the card that identify the issuer) and access to the national payment system through the bank’s regulatory standing. The bank manages the federal regulatory relationship; you manage the product, customer experience, and marketing. Monthly fees vary widely with program size, and setup costs add substantially to the upfront investment.
Applying for your own national bank charter through the Office of the Comptroller of the Currency is a different order of magnitude. Capitalization requirements are significantly higher, the application can take a year or more, and you take on direct examination and capital adequacy supervision that never ends.1Congress.gov. CRS Report R47447 A handful of fintechs have gone this route, but it only makes sense with deep backing and a long-term need for full control of the banking relationship.
A middle path is issuing private-label or co-branded cards. Private-label cards work only at a specific retailer and don’t need a Visa or Mastercard relationship. Co-branded cards carry a network logo and work everywhere, but you partner with both a bank and a network. Either approach reduces the regulatory footprint of a charter, at the cost of some control and margin.
Capital, Reserves, and Licensing Costs
Whatever structure you pick, you need a capitalization plan that convinces your sponsor bank (or federal regulators, if you charter directly) that you can absorb losses. That plan projects loss ratios, shows liquidity for daily settlement cycles where you pay merchants before collecting from cardholders, and holds reserves proportional to your outstanding credit exposure so you stay solvent if defaults spike.
Expect to include audited financial statements, letters of credit from your funding sources, and multi-year projections for transaction volume, interest income, and customer acquisition costs.
Payment networks run their own application process. Visa and Mastercard will ask for your funding sources, sponsor bank identity, three-to-five-year volume projections, and a description of your target customer so they can assess the risk profile of your program.
State licensing is its own line item. Most states require a surety bond before issuing a lending or money transmitter license; bond amounts generally range from $50,000 to $2,000,000 depending on projected volume and the state’s framework. State license application fees typically run from a few hundred to several thousand dollars per state, and you’ll need one in every state where you plan to lend. State regulators also want professional backgrounds, criminal history checks (including fingerprints), and financial disclosures for executive officers and major shareholders.
Federal Consumer Lending Rules You Have to Build Around
Federal law dictates how you disclose credit terms, change rates, decide who to lend to, and handle disputes. Getting these wrong exposes you to private lawsuits, class actions, and CFPB enforcement.
Truth in Lending Act
TILA requires standardized disclosures so applicants can compare offers across issuers.2Office of the Law Revision Counsel. 15 USC 1601 – Congressional Findings and Declaration of Purpose The APR, annual fees, grace period, and penalty terms have to appear in the tabular format commonly called a Schumer Box, prescribed by the CFPB, on every application, solicitation, and monthly statement.3Office of the Law Revision Counsel. 15 USC 1632 – Form of Disclosure; Additional Information Violations expose you to actual damages, statutory damages, class action liability, and attorney fees.4Office of the Law Revision Counsel. 15 USC 1640 – Civil Liability
CARD Act
The CARD Act of 2009 generally bars you from raising the APR, fees, or finance charges on a cardholder’s existing balance. Narrow exceptions cover variable rates tied to a public index, the expiration of a clearly disclosed promotional rate, and cardholders more than 60 days delinquent on a minimum payment. Even in the delinquency case, you must roll the rate back within six months if timely payments resume.5Office of the Law Revision Counsel. 15 USC 1666i-1 – Limits on Interest Rate, Fee, and Finance Charge Increases Applicable to Outstanding Balances The Act also constrains late fees; as of 2026, safe harbor thresholds allow up to $30 for a first late payment and $41 for a subsequent late payment within six billing cycles. A CFPB rule that would have capped late fees at $8 for large issuers was vacated by a federal court in 2025.
Equal Credit Opportunity Act
ECOA bans discrimination in credit on the basis of race, color, religion, national origin, sex, marital status, or age, and on whether an applicant’s income comes from public assistance or whether they’ve exercised rights under consumer protection laws.6eCFR. 12 CFR Part 202 – Equal Credit Opportunity Act (Regulation B) It applies at every stage: marketing, underwriting, credit limit assignment, and account management. Adverse actions (denials, credit limit cuts, closures, unfavorable term changes) require a written notice with the specific reasons and a statement of the applicant’s ECOA rights. If you use machine learning in underwriting, your models have to be tested and documented to catch outcomes that are discriminatory even when the inputs look neutral. This is where many fintech issuers get into trouble.
Fair Credit Billing Act
When a cardholder sends a written billing dispute, you have 30 days to acknowledge it and two billing cycles (no more than 90 days) to resolve it. During the investigation, the disputed amount can’t be reported delinquent or sent to collection.7Federal Trade Commission. Fair Credit Billing Act Your compliance manual needs written procedures for intake, tracking, investigation, and resolution within these windows.
Credit Bureau Reporting
Once you’re furnishing account data to Experian, Equifax, or TransUnion, you cannot report information you know or have reason to believe is inaccurate, and you must correct prior data promptly if you discover it was wrong.8Office of the Law Revision Counsel. 15 USC 1681s-2 – Responsibilities of Furnishers of Information to Consumer Reporting Agencies Consumer disputes trigger a reasonable investigation and, where the data turns out to be wrong, corrections to every bureau you reported to.9eCFR. 16 CFR Part 660 – Duties of Furnishers of Information to Consumer Reporting Agencies Written accuracy and integrity policies are required and have to be reviewed periodically.
AML, KYC, and Sanctions Screening
Federal rules require every operator of a credit card system to maintain a written anti-money laundering program approved by senior management, with policies designed to prevent your program from being used to facilitate money laundering or terrorist financing.10eCFR. 31 CFR 1028.210 – Anti-Money Laundering Programs for Operators of Credit Card Systems
Alongside that, a Customer Identification Program collects the applicant’s name, date of birth, address, and taxpayer identification number (or equivalent for non-U.S. persons) at account opening. Credit card issuers are specifically permitted to verify this information through third-party sources rather than requiring in-person documents, which is what makes online applications workable.11eCFR. 31 CFR 1020.220 – Customer Identification Program You’ll also need procedures to screen applicants against government watchlists.
The Technology You Have to Build or Buy
Three systems have to exist and talk to each other in real time: a payment processor, an origination system, and a servicing system.
Payment Processor
The processor handles authorization, clearing, and settlement of every transaction. Legacy players like Fiserv and TSYS dominate the market; cloud-native platforms such as Marqeta offer more flexibility for custom features and real-time controls. Integration runs through APIs, and the processor will price the relationship against your projected transaction volume and peak load.
Origination System
This is what turns applications into accounts. It pulls credit data, runs it through your scoring model (proprietary or third-party), and returns an approval or denial with a credit limit and rate. Applicants expect a decision in seconds.
Servicing System
Servicing tracks balances, applies payments, calculates interest, generates monthly statements, and produces the data you send to the credit bureaus. It also powers the mobile app and web portal where cardholders view transactions, pay bills, and manage security settings. Available-credit figures have to stay current across all three systems.
Physical Cards
If you’re issuing plastic (most programs still do, alongside digital wallets), you’ll finalize specifications for EMV chip, contactless, magnetic stripe, and security features like holograms. Production facilities have to meet the security requirements of the Payment Card Industry Security Standards Council, which governs how cardholder data is handled during manufacturing and personalization.
Data Security: PCI DSS and the Safeguards Rule
Two overlapping frameworks govern how you protect cardholder information.
PCI DSS 4.0 became fully enforceable in April 2025 and applies to every entity that stores, processes, or transmits payment card data. Encryption at rest and in transit, strict access controls, regular vulnerability testing, and detailed logging are required, and you’ll pass through an annual compliance assessment. Ongoing PCI compliance is a permanent budget line.
The Gramm-Leach-Bliley Act’s Safeguards Rule requires a written information security program. The FTC’s current rule sets out nine mandatory elements: designating a qualified individual to run the program, written risk assessments, encryption of customer information, multi-factor authentication, staff security training, service provider oversight, a written incident response plan, and annual reporting to the board on the program’s status. Customer information has to be securely disposed of no later than two years after your last use of it to serve that customer.12Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know
The two regimes overlap but are enforced by different bodies: PCI DSS through the card networks and acquiring banks, the Safeguards Rule by the FTC and federal banking regulators. Your systems architecture documentation should map each requirement to the specific control that satisfies it.
Application, Testing, and Go-Live
With the documentation package assembled, you submit to the sponsor bank and the payment network. Most submissions run through secure digital portals; some state licensing bodies still require physical copies by certified mail. The bank and network review your financial projections, risk management strategy, compliance framework, and technical readiness, usually across multiple rounds of follow-up.
On approval, the network assigns a BIN range to your program. Then comes testing: the processor simulates thousands of transactions across authorizations, declines, reversals, chargebacks, and edge cases while your developers work with the bank’s technical team to close API errors and validate load handling. Go-live authorization comes only after those stress tests pass.
Timelines vary with program complexity, partner responsiveness, and how clean your documentation is. Simple programs with experienced sponsor banks move faster; novel products with untested risk profiles take longer. Your fraud detection and reporting systems should be live and processing test data throughout, so they’re validated before real money moves.
Ongoing Compliance After Launch
The compliance load rises once real accounts are open.
Suspicious activity involving $5,000 or more that may indicate money laundering, structuring, or other illegal activity triggers a Suspicious Activity Report to FinCEN, generally within 30 calendar days of detection.13Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
You’ll have IRS reporting obligations too. Interest paid on credit balances or interest-equivalent rewards of $10 or more in a calendar year triggers a Form 1099-INT.14Internal Revenue Service. Instructions for Forms 1099-INT and 1099-OID Third-party settlement organizations file Form 1099-K for payees who cross $20,000 in gross payments and 200 transactions in a calendar year.15Internal Revenue Service. Publication 1099 General Instructions for Certain Information Returns – For Use in Preparing 2026 Returns
Security work is continuous. PCI DSS is not a one-time certification; you’ll do continuous monitoring or, at minimum, annual penetration testing and vulnerability assessments every six months. The Safeguards Rule requires your qualified individual to report to the board at least annually on risk assessments, test results, incidents, and recommended changes. Sponsor banks and business partners commonly require SOC 2 Type II audit reports as well, which evaluate your controls over a period (typically six months). All of this is a permanent operating expense.
One item that catches new issuers off guard: credit balances on cardholder accounts (from refunds or overpayments) that go unclaimed can’t be kept indefinitely. Every state has unclaimed property laws requiring you to turn dormant credit balances over to the state after a set dormancy period, commonly three to five years. Tracking these balances, sending required notices, and remitting funds to the correct state is an operational process to build from day one.